XTRIKE SAST SECURITY · PLATFORM 05
XTRIKE SAST DESK — Proof-Driven SAST Validation
Print ReportNew Hybrid Scan
INTER-PROCEDURAL TAINT GRAPH

Inter-Procedural Data Flow DAG

Track untrusted input propagation across controllers, services, and queries to identify the exact sanitizer bypass.

TAINT SOURCE
req.body.searchQuery
routes/api.ts:L14
→
CONTROLLER
searchController.handle()
controllers/search.ts:L28
→
SANITIZER GAP
No Escaping Applied
Bypassed Validation
→
DANGEROUS SINK
db.queryRaw(sql)
db/postgres.ts:L92

Taint Flow Analysis: SINK

The user parameter is passed across 3 stack frames without input sanitization or parameterized bindings, resulting in direct execution at PostgreSQL sink.